Method, Apparatus, and System of Distributing Data of Virtual Subscriber Identity Module

ABSTRACT

A method, an apparatus, and a system for distributing data of a virtual subscriber identity module (VSIM) where a terminal device acquires a graphic code from a distribution client; acquires the temporary data of the VSIM and the service authentication code that are included in the graphic code; registers with a mobile network according to the temporary data of the VSIM; connects to the management server through the mobile network; sends to the management server, a request for downloading formal data of the VSIM; and if the authentication is passed, the management server acquires formal data that is of the VSIM and corresponding to the service authentication code, and sends the formal data of the VSIM to the terminal device.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.14/900,804, filed on Dec. 22, 2015, which is a National Stage ofInternational Patent Application No. PCT/CN2014/075699, filed on Apr.18, 2014. The aforementioned patent applications are hereby incorporatedby reference in their entireties.

TECHNICAL FIELD

The present disclosure relates to mobile communications technologies,and in particular, to a method, an apparatus, and a system fordistributing data of a virtual subscriber identity module (VSIM).

BACKGROUND

A subscriber identity module (SIM) included in a conventional terminaldevice exists in a form of a physical card, and a VSIM may replace thephysical SIM card to implement a function of the physical SIM card. Thefunction includes storing subscriber data, for example, an internationalmobile subscriber identity (IMSI); and an encryption algorithm andinformation about a key that are in the SIM, where the encryptionalgorithm includes A3 and A8 and may be preset in a terminal device, andthe information about a key includes a Key identifier (Ki). The Ki is akey for transferring encrypted data between the SIM card and anoperator, and the Ki cooperates with the IMSI and serves as anauthentication key for authentication of a subscriber identity when theterminal device accesses a network via the card. The Ki of the SIM cardof a mobile phone is cracked, numerous phone cards of a same number maybe copied. After a VSIM is used, a mobile operator may not use an entitySIM to bind a telephone number to a terminal. While the mobile operatordirectly provides the VSIM to the terminal, which reduces a cost ofaccessing a network by a subscriber, a production cost of the terminal,and operating and management costs of the mobile operator.

However, an existing distributing method of a VSIM requires that theterminal device must have a function of accessing a network to acquireinstallation information of a VSIM, which limits distribution andapplication of the VSIM.

SUMMARY

In view of this, embodiments of the present disclosure provide a method,an apparatus, and a system for distributing data of a virtual subscriberidentity module, so as to solve a problem that only a terminal devicethat must have a function of accessing a network can acquireinstallation information of a VSIM.

According to a first aspect, an embodiment of the present disclosureprovides a method for distributing data of a VSIM, including acquiring,by a terminal device, a graphic code from a distribution client, wherethe graphic code includes temporary data of a VSIM and a serviceauthentication code, and the graphic code is provided by a managementserver to the distribution client; acquiring, by the terminal device,the temporary data of the VSIM and the service authentication code thatare included in the graphic code; registering, by the terminal device,with a mobile network according to the temporary data of the VSIM, andconnecting to the management server through the mobile network; sending,by the terminal device to the management server, a request fordownloading formal data of the VSIM, where the request for downloadingthe formal data of the VSIM carries the service authentication code, sothat the management server performs authentication on the terminaldevice according to the service authentication code; and if theauthentication is passed, the management server acquires formal datathat is of the VSIM and corresponding to the service authenticationcode, and sends the formal data of the VSIM to the terminal device;receiving, by the terminal device, the formal data of the VSIM that issent by the management server; and registering, by the terminal device,with the mobile network according to the formal data of the VSIM.

With reference to the first aspect, in a first possible implementationmanner of the first aspect, the temporary data of the VSIM istemporarily valid, and is deregistered after the terminal devicereceives the formal data of the VSIM that is sent by the managementserver, so that the terminal device reregisters with the mobile networkaccording to the formal data of the VSIM.

With reference to the first aspect or the first possible implementationmanner of the first aspect, in a second possible implementation mannerof the first aspect, the graphic code is a two-dimensional code.

With reference to the first aspect and either of the first and thesecond possible implementation manners of the first aspect, in a thirdpossible implementation manner of the first aspect, the acquiring, bythe terminal device, the temporary data of the VSIM and the serviceauthentication code that are included in the graphic code includesscanning, by the terminal device, the graphic code to acquire thetemporary data of the VSIM and the service authentication code that areincluded in the graphic code.

With reference to the first aspect and any one of the first to the thirdpossible implementation manners of the first aspect, in a fourthpossible implementation manner of the first aspect, the acquiring, by aterminal device, a graphic code from a distribution client includesacquiring, by the terminal device, the graphic code from thedistribution client using a camera.

With reference to the first aspect and any one of the first to thefourth possible implementation manners of the first aspect, in a fifthpossible implementation manner of the first aspect, before theregistering, by the terminal device, with a mobile network according tothe temporary data of the VSIM, the method further includes storing, bythe terminal device, the temporary data of the VSIM, and writing thestored temporary data of the VSIM to a modem of the terminal device; andbefore the registering, by the terminal device, with the mobile networkaccording to the formal data of the VSIM, the method further includesstoring, by the terminal device, the formal data of the VSIM, andwriting the stored formal data of the VSIM to the modem of the terminaldevice, so as to overwrite the temporary data of the VSIM that has beenwritten to the modem.

According to a second aspect, an embodiment of the present disclosureprovides a method for distributing data of a VSIM, includingencapsulating, by a management server, temporary data of a VSIM and aservice authentication code in a graphic code, where the serviceauthentication code is used by a terminal device to download formal dataof the VSIM; providing, by the management server, the graphic code to adistribution client, so that the terminal device acquires the graphiccode from the distribution client, further acquires the temporary dataof the VSIM and the service authentication code, registers with a mobilenetwork according to the temporary data of the VSIM, and sends, to themanagement server according to the service authentication code, arequest for downloading the formal data of the VSIM; receiving, by themanagement server, the request, sent by the terminal device, fordownloading the formal data of the VSIM, where the request fordownloading the formal data of the VSIM carries the serviceauthentication code; performing, by the management server,authentication on the terminal device according to the serviceauthentication code; and if the authentication is passed, sending, bythe management server, formal data that is of the VSIM and correspondingto the service authentication code to the terminal device.

With reference to the second aspect, in a first possible implementationmanner of the second aspect, before the sending, by the managementserver, formal data that is of the VSIM and corresponding to the serviceauthentication code to the terminal device, the method further includesdetermining, by the management server, that a state of the formal datathat is of the VSIM and corresponding to the service authentication codeis an unused state; and after the sending, by the management server,formal data that is of the VSIM and corresponding to the serviceauthentication code to the terminal device, the method further includesmarking, by the management server, the state of the formal data of theVSIM as a used state.

With reference to the second aspect or the first possible implementationmanner of the second aspect, in a second possible implementation mannerof the second aspect, the graphic code is a two-dimensional code.

With reference to the second aspect and either of the first and thesecond possible implementation manners of the second aspect, in a thirdpossible implementation manner of the second aspect, after the sending,by the management server, formal data that is of the VSIM andcorresponding to the service authentication code to the terminal device,the method further includes sending, by the management server to themobile network, a request for deregistering the temporary data of theVSIM, so that a mobile switching center (MSC) on the mobile networkderegisters the temporary data of the VSIM, and the terminal deviceregisters with the mobile network according to the formal data of theVSIM.

According to a third aspect, an embodiment of the present disclosureprovides a terminal device, including a first acquiring moduleconfigured to acquire a graphic code from a distribution client, wherethe graphic code includes temporary data of a VSIM and a serviceauthentication code, and the graphic code is provided by a managementserver to the distribution client; a second acquiring module configuredto acquire the temporary data of the VSIM and the service authenticationcode that are included in the graphic code; a network processing moduleconfigured to register with a mobile network according to the temporarydata of the VSIM, and connect to the management server through themobile network; a sending module configured to send, to the managementserver, a request for downloading formal data of the VSIM, where therequest for downloading the formal data of the VSIM carries the serviceauthentication code, so that the management server performsauthentication on the terminal device according to the serviceauthentication code; and if the authentication is passed, the managementserver acquires formal data that is of the virtual subscriber identitymodule and corresponding to the service authentication code, and sendsthe formal data of the VSIM to the terminal device; and a receivingmodule configured to receive the formal data of the VSIM that is sent bythe management server, where the network processing module is furtherconfigured to register with the mobile network according to the formaldata of the VSIM.

With reference to the third aspect, in a first possible implementationmanner of the third aspect, the temporary data of the VSIM istemporarily valid, and is deregistered after the terminal devicereceives the formal data of the VSIM that is sent by the managementserver, so that the terminal device reregisters with the mobile networkaccording to the formal data of the VSIM.

With reference to the third aspect or the first possible implementationmanner of the third aspect, in a second possible implementation mannerof the third aspect, the graphic code is a two-dimensional code.

With reference to the third aspect and either of the first and thesecond possible implementation manners of the third aspect, in a thirdpossible implementation manner of the third aspect, the second acquiringmodule is configured to scan the graphic code to acquire the temporarydata of the VSIM and the service authentication code that are includedin the graphic code.

With reference to the third aspect and any one of the first to the thirdpossible implementation manners of the third aspect, in a fourthpossible implementation manner of the third aspect, the first acquiringmodule is configured to acquire the graphic code from the distributionclient using a camera.

With reference to the third aspect and any one of the first to thefourth possible implementation manners of the third aspect, in a fifthpossible implementation manner of the third aspect, the terminal devicefurther includes a storage module and a writing module, where thestorage module is configured to, before the network processing moduleregisters with the mobile network according to the temporary data of theVSIM, store the temporary data of the VSIM; the writing module isconfigured to write the temporary data that is of the VSIM and stored bythe storage module to a modem of the terminal device; the storage moduleis further configured to, before the network processing module registerswith the mobile network according to the formal data of the VSIM, storethe formal data of the VSIM; and the writing module is furtherconfigured to write the stored formal data of the VSIM to the modem ofthe terminal device, so as to overwrite the temporary data of the VSIMthat has been written to the modem.

According to a fourth aspect, an embodiment of the present disclosureprovides a management server, including a graphic code encapsulatingmodule configured to encapsulate temporary data of a VSIM and a serviceauthentication code in a graphic code, where the service authenticationcode is used by a terminal device to download formal data of the VSIM; aproviding module configured to provide the graphic code to adistribution client, so that the terminal device acquires the graphiccode from the distribution client, further acquires the temporary dataof the VSIM and the service authentication code, registers with a mobilenetwork according to the temporary data of the VSIM, and sends, to themanagement server according to the service authentication code, arequest for downloading the formal data of the VSIM; a receiving moduleconfigured to receive the request, sent by the terminal device, fordownloading the formal data of the VSIM, where the request fordownloading the formal data of the VSIM carries the serviceauthentication code; an authentication module configured to performauthentication on the terminal device according to the serviceauthentication code; and a sending module configured to, if theauthentication module passes the authentication, send formal data thatis of the VSIM and corresponding to the service authentication code tothe terminal device.

With reference to the fourth aspect, in a first possible implementationmanner of the fourth aspect, before the sending module sends the formaldata that is of the VSIM and corresponding to the service authenticationcode to the terminal device, the authentication module is furtherconfigured to determine that a state of the formal data that is of theVSIM and corresponding to the service authentication code is an unusedstate; and after the sending module sends the formal data that is of theVSIM and corresponding to the service authentication code to theterminal device, the authentication module is further configured to markthe state of the formal data of the VSIM as a used state.

With reference to the fourth aspect or the first possible implementationmanner of the fourth aspect, in a second possible implementation mannerof the fourth aspect, the graphic code is a two-dimensional code.

With reference to the fourth aspect and either of the first and thesecond possible implementation manners of the fourth aspect, in a thirdpossible implementation manner of the fourth aspect, after sending theformal data that is of the VSIM and corresponding to the serviceauthentication code to the terminal device, the sending module isfurther configured to send, to the mobile network, a request forderegistering the temporary data of the VSIM, so that an MSC on themobile network deregisters the temporary data of the VSIM, and theterminal device registers with the mobile network according to theformal data of the VSIM.

According to a fifth aspect, an embodiment of the present disclosureprovides a terminal device, including a processor, a memory, a modem, afirst interface, and a second interface that are connected using a bus,where the first interface is configured to acquire a graphic code from adistribution client, where the graphic code includes temporary data of aVSIM and a service authentication code, and the graphic code is providedby a management server to the distribution client; the memory isconfigured to store program code, and the processor executes the programcode so as to implement the following steps: acquiring, from the graphiccode acquired by the first interface, the temporary data of the VSIM andthe service authentication code that are included in the graphic code;storing, in the memory, the temporary data of the VSIM and the serviceauthentication code, and writing the temporary data of the VSIM to themodem; invoking the second interface so as to register with a mobilenetwork according to the temporary data of the VSIM, and connect to themanagement server through the mobile network; send, to the managementserver, a request for downloading formal data of the VSIM, where therequest for downloading the formal data of the VSIM carries the serviceauthentication code, so that the management server performsauthentication on the terminal device according to the serviceauthentication code; and if the authentication is passed, the managementserver acquires formal data that is of the virtual subscriber identitymodule and corresponding to the service authentication code, and sendsthe formal data of the VSIM to the terminal device; and receive theformal data of the VSIM that is sent by the management server; storing,in the memory, the formal data of the VSIM that is received by thesecond interface, and writing the formal data of the VSIM to the modem,so as to overwrite the temporary data of the VSIM that has been writtento the modem; and invoking the second interface so as to register withthe mobile network according to the formal data of the VSIM.

With reference to the fifth aspect, in a first possible implementationmanner of the fifth aspect, the first interface is a camera; and theprocessor invokes the camera to acquire the graphic code from thedistribution client.

According to a sixth aspect, an embodiment of the present disclosureprovides a management server, including a processor, a memory, a firstinterface, and a second interface that are connected using a bus, wherethe memory is configured to store temporary data of a VSIM, a serviceauthentication code, formal data of the VSIM, and program code, and theprocessor executes the program code so as to implement the followingsteps: encapsulating the temporary data of the VSIM and the serviceauthentication code in a graphic code; invoking the first interface toprovide the graphic code to a distribution client, so that a terminaldevice acquires the graphic code from the distribution client, furtheracquires the temporary data of the VSIM and the service authenticationcode that are included in the graphic code, registers with a mobilenetwork according to the temporary data of the VSIM, and sends, to themanagement server according to the service authentication code, arequest for downloading the formal data of the VSIM; invoking the secondinterface to receive the request, sent by the terminal device, fordownloading the formal data of the VSIM, where the request fordownloading the formal data of the VSIM carries the serviceauthentication code; performing authentication on the terminal deviceaccording to the service authentication code; determining that a stateof the formal data that is of the VSIM and corresponding to the serviceauthentication code is an unused state; if the authentication is passedand it is determined that the state of the formal data of the VSIM isthe unused state, invoking the second interface to send the formal datathat is of the VSIM and corresponding to the service authentication codeto the terminal device; and marking the state of the formal data of theVSIM as a used state.

According to a seventh aspect, an embodiment of the present disclosureprovides a system for distributing data of a VSIM, including at leastone terminal device according to the fifth aspect or the first possibleimplementation manner of the fifth aspect, and the management serveraccording to the sixth aspect, and a distribution client.

Using the solutions, according to the embodiments provided in thepresent disclosure, a terminal device acquires, from a distributionclient, a graphic code that includes temporary data of a VSIM and aservice authentication code, so as to register with a mobile networkaccording to the temporary data of the VSIM, and further connect to amanagement server to download formal data that is of the VSIM andcorresponding to the service authentication code, which overcomes aproblem that distribution of data of a VSIM is limited because anexisting terminal device needs to have a network connection capabilityto acquire data of the VSIM from the management server. The temporarydata of the VSIM and the service authentication code are acquired fromthe distribution client and further the formal data of the VSIM isacquired from the management server according to the serviceauthentication code, which increases security, flexibility, andconvenience of acquiring the data of the VSIM by the terminal device,and improves efficiency in distributing the data of the VSIM.

BRIEF DESCRIPTION OF THE DRAWINGS

To describe the technical solutions in the embodiments of the presentdisclosure more clearly, the following briefly introduces theaccompanying drawings required for describing the embodiments. Theaccompanying drawings in the following description show merely someembodiments of the present disclosure, and persons of ordinary skill inthe art may still derive other drawings from these accompanying drawingswithout creative efforts.

FIG. 1 is a flowchart of Embodiment 1 of a method for distributing dataof a VSIM according to the present disclosure;

FIG. 2 is a flowchart of Embodiment 2 of a method for distributing dataof a VSIM according to the present disclosure;

FIG. 3 is a schematic structural diagram of Embodiment 1 of a terminaldevice according to the present disclosure;

FIG. 4 is a schematic structural diagram of Embodiment 1 of a managementserver according to the present disclosure;

FIG. 5 is a schematic structural diagram of Embodiment 2 of a terminaldevice according to the present disclosure;

FIG. 6 is a schematic structural diagram of Embodiment 2 of a managementserver according to the present disclosure; and

FIG. 7 is a schematic structural diagram of an embodiment of a systemfor distributing data of a VSIM according to the present disclosure.

DETAILED DESCRIPTION

To make the objectives, technical solutions, and advantages of thepresent disclosure clearer, the following further describes the presentdisclosure in detail with reference to the accompanying drawings. Thedescribed embodiments are merely a part rather than all of theembodiments of the present disclosure. All other embodiments obtained bypersons of ordinary skill in the art based on the embodiments of thepresent disclosure without creative efforts shall fall within theprotection scope of the present disclosure.

FIG. 1 is a flowchart of Embodiment 1 of a method for distributing dataof a VSIM according to the present disclosure. The method embodiment isperformed by a terminal device, where the terminal device may supportuse of the data of a VSIM. As shown in FIG. 1, the method embodimentincludes the following steps.

S101. A terminal device acquires a graphic code from a distributionclient, where the graphic code includes temporary data of the VSIM and aservice authentication code, and the graphic code is provided by amanagement server to the distribution client.

S102. The terminal device acquires the temporary data of the VSIM andthe service authentication code that are included in the graphic code.

S103. The terminal device registers with a mobile network according tothe temporary data of the VSIM, and connects to the management serverthrough the mobile network.

Before the terminal device registers with the mobile network accordingto the temporary data of the VSIM, the method further includes storing,by the terminal device, the temporary data of the VSIM, and writing thestored temporary data of the VSIM to a modem (Modem) of the terminaldevice.

S104. The terminal device sends, to the management server, a request fordownloading formal data of the VSIM, where the request for downloadingthe formal data of the VSIM carries the service authentication code, sothat the management server performs authentication on the terminaldevice according to the service authentication code; and if theauthentication is passed, the management server acquires formal datathat is of the virtual subscriber identity module and corresponding tothe service authentication code, and sends the formal data of the VSIMto the terminal device.

S105. The terminal device receives the formal data of the VSIM that issent by the management server.

S106. The terminal device registers with the mobile network according tothe formal data of the VSIM.

Before the terminal device registers with the mobile network accordingto the formal data of the VSIM, the method further includes storing, bythe terminal device, the formal data of the VSIM, and writing the storedformal data of the VSIM to the modem of the terminal device, so as tooverwrite the temporary data of the VSIM that has been written to themodem.

The temporary data of the VSIM is temporarily valid, and is deregisteredafter the terminal device receives the formal data of the VSIM that issent by the management server, so that the terminal device reregisterswith the mobile network according to the formal data of the VSIM.

Preferably, the graphic code may be a two-dimensional code.

Preferably, S102 includes that the terminal device scans the graphiccode to acquire the temporary data of the VSIM and the serviceauthentication code that are included in the graphic code.

Preferably, in S101, that the terminal device acquires the graphic codefrom the distribution client includes that the terminal device acquiresthe graphic code from the distribution client using a camera.

The terminal device acquires, from the distribution client, the graphiccode in which the temporary data of the VSIM and the serviceauthentication code are encapsulated, acquires the temporary data of theVSIM and the service authentication code from the graphic code, storesthe temporary data of the VSIM and the service authentication code,writes the temporary data of the VSIM to the Modem of the terminaldevice, so as to register with the mobile network according toinformation included in the temporary data of the VSIM and connect tothe management server to acquire a network connection capability. Then,the request for downloading the formal data of the VSIM is sent to themanagement server, where the request for downloading carries the serviceauthentication code, so that the management server returns correspondingformal data of the VSIM to the terminal device according to the serviceauthentication code. After receiving the formal data of the VSIM, theterminal device stores the formal data of the VSIM, and after writingthe formal data of the VSIM to the Modem to overwrite the temporary dataof the VSIM, reregisters with the mobile network according to the formaldata of the VSIM. Then, the data of the VSIM may be used to provide afunction similar to that of a physical SIM card.

During specific implementation, the terminal device acquires the graphiccode from the distribution client. The graphic code includes but is notlimited to a bar code, a two-dimensional code, or the like, and may beprovided in advance by the management server to the distribution client,may be provided to the terminal device by the management server afterthe distribution client makes a request to the management serveraccording to a requirement of the terminal device, or may be sent by anoperator to the distribution client through a network secure channelaccording to an operating policy and using the management server.According to different distribution clients, the graphic code may beprovided in a manner of a graphic code of a corrugated board or anelectronic graphic code. If the graphic code is a graphic code of acorrugated board, a preferable manner is that the graphic code may beprovided to the distribution client after a protective film is added tothe graphic code so as to improve security of the graphic code andprevent the graphic code from being distributed at a second time.Correspondingly, after the terminal device acquires the graphic code ofa corrugated board, the protective film on the graphic code needs to beremoved. If the graphic code is an electronic graphic code, a manner ofacquiring, by the terminal device, the graphic code from thedistribution client includes but is not limited to acquiring the graphiccode using a physical connection such as Universal Serial Bus (USB)transmission or network transmission. Preferably, the terminal devicemay acquire the graphic code from a display device of the distributionclient using the camera.

The distribution client may be a distribution point of an existingphysical SIM card, and preferably, may also be an added client machine.For a distribution point, the management server mainly provides thegraphic code in a form of a corrugated board, and may also include theelectronic graphic code. The distribution point may store, on a physicalmedium, pieces of data of the electronic graphic code one by one in amanner that facilitates distribution, for example, on an optical disc,and a USB flash drive. A manner of the storage medium is not limited,and then the data is provided to the terminal device, so that theterminal device may acquire the graphic code from the physical medium.

For a client machine, the management server mainly sends the electronicgraphic code to the distribution client through the secure channel, andthe client machine may provide the graphic code to the terminal devicein different forms according to a requirement of a user of the terminaldevice. Methods for providing, by the distribution client, the graphiccode to the terminal device to allow the terminal device to acquire dataof the VSIM include but are not limited to the following several methodsbelow.

Method 1: The distribution client prints the graphic code on acorrugated board and provides the graphic code to the terminal device,so that the terminal device scans the graphic code on the corrugatedboard so as to acquire the data of the VSIM.

Method 2: The distribution client displays the graphic code on aninterface to the terminal device, so that the terminal device mayacquire, using a camera, the graphic code displayed on the interface.

Method 3: The distribution client transmits a two-dimensional code tothe terminal device using a physical connection, so that the terminaldevice stores the graphic code and scans the graphic code to acquire thedata of the VSIM, where the physical connection may be transmissionthrough a USB interface, or transmission through a network interfacesuch as BLUETOOTH or local area network Wireless Fidelity (WiFi), whichis not limited in the present disclosure.

After the terminal device acquires the graphic code, acquiring thetemporary data of the VSIM and the service authentication code in thegraphic code may be obtained by scanning the graphic code using graphiccode scan software built in the terminal device, where the graphic codescan software includes but is not limited to a bar code reader, and agraphic code scan software such as a two-dimensional code scan software.

The temporary data of the VSIM that is encapsulated in the graphic codeby the management server may include but is not limited to an IMSI, amobile number, and information about a key, such as a Ki. Because the Kiis relatively important, after being encrypted using a fixed password,the Ki may be encapsulated in the graphic code, where the fixed passwordmay be preset in a terminal device that supports the VSIM, so that afteracquiring the temporary data of the VSIM, the terminal device mayperform decryption processing on information about the encrypted Ki toobtain information about the Ki and write the information about the Kiand the like to a Modem of the terminal device, which in this case isequivalent to inserting an entity SIM card into the terminal device,send the obtained information about the Ki to a mobile network accordingto information about a key, such as the IMSI and the Ki and using atransceiver such as an antenna. If authentication that is performedusing an MSC of the mobile network is passed, the terminal deviceregisters with the mobile network; further connects to the managementserver through the mobile network; sends, according to serviceauthentication code, to the management server, the request fordownloading the formal data of the VSIM; receives the formal data of theVSIM that is sent by the management server; replaces the temporary dataof the VSIM that has been written to the Modem with the formal data ofthe VSIM; and registers with the mobile network according to the formaldata of the VSIM.

In this method embodiment, a terminal device acquires, from adistribution client, a graphic code that includes temporary data of aVSIM and a service authentication code, so as to register with a mobilenetwork according to the temporary data of the VSIM, and further connectto a management server to download formal data that is of the VSIM andcorresponding to the service authentication code, which overcomes aproblem that distribution of data of a VSIM is limited because anexisting terminal device needs to have a network connection capabilityto acquire the data of the VSIM from the management server. Thetemporary data of the VSIM and the service authentication code areacquired from the distribution client and further the formal data of theVSIM is acquired from the management server according to the serviceauthentication code, which increases security, flexibility, andconvenience of acquiring the data of the VSIM by the terminal device,and improves efficiency in distributing the data of the VSIM.

FIG. 2 is a flowchart of Embodiment 2 of a method for distributing dataof a VSIM according to the present disclosure. The method embodiment isperformed by a management server, where the management server may beused by an operator to manage the data of a VSIM. As shown in FIG. 2,the method embodiment includes the following steps.

S201. A management server encapsulates temporary data of the VSIM and aservice authentication code in a graphic code, where the serviceauthentication code is used by a terminal device to download formal dataof the VSIM.

S202. The management server provides the graphic code to a distributionclient, so that the terminal device acquires the graphic code from thedistribution client, further acquires the temporary data of the VSIM andthe service authentication code, registers with a mobile networkaccording to the temporary data of the VSIM, and sends, to themanagement server according to the service authentication code, arequest for downloading the formal data of the VSIM.

The providing, by the management server, the graphic code to thedistribution client may be sending the graphic code upon a purchaserequirement of the distribution client, may be sending, by an operator,an electronic graphic code to the distribution client through a networksecure channel according to an operating policy and using the managementserver, or may be directly printing, by the management server, thegraphic code on corrugated boards, and after a part of the graphic codeundergoes shielding protection processing, directly wholesaling thecorrugated boards to a distributor, so that the distributor may directlyprovide two-dimensional codes of the corrugated boards to users ofterminal devices. After acquiring the corrugated card, the user removesshielding, scans the graphic code to acquire the temporary data of theVSIM, and registers with the mobile network using an IMSI andinformation about Ki that are included in the temporary data of theVSIM.

Optionally, at the same time when the management server sends thegraphic code to the distribution client, the management server may alsosimultaneously send the VSIM serial number, which is used to identifyuniqueness, generation time, and expiration time of the data of theVSIM, and other data, for example, information that may facilitate useof the user, such as a brand and a price, where the expiration time isused to prompt the terminal device that the temporary data of the VSIMmust be used within a specified time.

S203. The management server receives the request, sent by the terminaldevice, for downloading the formal data of the VSIM, where the requestfor downloading the formal data of the VSIM carries the serviceauthentication code.

S204. The management server performs authentication on the terminaldevice according to the service authentication code.

S205. If the authentication is passed, the management server sendsformal data that is of the VSIM and corresponding to the serviceauthentication code to the terminal device.

Preferably, in S205, before the management server sends the formal datathat is of the VSIM and corresponding to the service authentication codeto the terminal device, the method further includes the following step:the management server determines that a state of the formal data that isof the VSIM and corresponding to the service authentication code is anunused state; and if determining that the state of the formal data thatis of the VSIM and corresponding to the service authentication code is aused state, the management server rejects sending the formal data of theVSIM to the terminal device, so as to prevent the formal data of theVSIM from being stolen, or ensure that even if the formal data of theVSIM is stolen, the formal data of the VSIM cannot be used tofraudulently use an account of another person to cause a loss to theuser.

After the management server sends the formal data that is of the VSIMand corresponding to the service authentication code to the terminaldevice, the method embodiment further includes the following step: themanagement server marks the state of the formal data of the VSIM as theused state.

Preferably, the graphic code may be a two-dimensional code.

Optionally, in S205, after the management server sends the formal datathat is of a VSIM and corresponding to the service authentication codeto the terminal device, the method embodiment further includes thefollowing step: the management server sends a request for deregisteringthe temporary data of the VSIM to the mobile network, so that an MSC onthe mobile network deregisters the temporary data of the VSIM, and theterminal device registers with the mobile network according to theformal data of the VSIM.

The temporary data of the VSIM or formal data of the VSIM may include anIMSI, a mobile number, and information about a key, such as a Ki, andthe like. Because information about the Ki is relatively important,after being encrypted using a fixed password, the Ki may be encapsulatedin the graphic code, where the fixed password may be preset in aterminal device that supports the VSIM, so that after acquiring thetemporary data of the VSIM or the formal data of the VSIM, the terminaldevice may use the preset fixed password to decrypt information aboutthe encrypted Ki that is included in the temporary data of the VSIM orthe formal data of the VSIM to obtain the information about the Ki. Thetemporary data of the VSIM is temporarily usable, and a main objectiveof the temporary data of the VSIM is to enable a mobile device to accessan operator network or the Internet after the mobile device registerswith the mobile network, then connect to the management server anddownload formal data that is of the VSIM and permanently usable. A useperiod may be set for the temporary data of the VSIM, and the temporarydata of the VSIM becomes invalid after the use period expires. Becausethe objective of using the temporary data of the VSIM is to download theformal data of the VSIM, control may be performed on a network side sothat a terminal device that uses a temporary VSIM to register with anetwork can access only a specified server, which includes themanagement server.

After the management server acquires the data of the VSIM from a mobilecore network, the acquired data of the VSIM includes the formal data ofthe VSIM and the temporary data of the VSIM, where the temporary data ofthe VSIM can be used to connect only to the specified server, forexample, the management server. After the temporary data of the VSIM isencrypted, the temporary data of the VSIM and the service authenticationcode are encapsulated in the graphic code, an electronic graphic code isdistributed to the distribution client through the network securechannel, or the graphic code is printed on a corrugated board, shieldingprotection processing is performed on an area of the graphic code, andthe corrugated board is wholesaled to the distribution client. Afteracquiring the graphic code from the distribution client and furtherobtaining the temporary data of the VSIM and the service authenticationcode that are included in the graphic code, the terminal deviceregisters with the mobile network using an IMSI and information about akey that are included in the temporary data of the VSIM. Then, after theterminal device connects to the management server through the mobilenetwork, the management server receives a request, sent by the terminaldevice, for downloading the formal data of the VSIM, where the requestcarries the service authentication code, and performs authentication onthe terminal device according to the received service authenticationcode; and if the authentication is passed and it is determined that thestate of the formal data that is of the VSIM and corresponding to theservice authentication code is the unused state, the management servermay send the formal data of the VSIM to the terminal device through thenetwork secure channel, and otherwise, rejects the request, from theterminal device, for downloading the formal data of the VSIM. Aftersending the formal data of the VSIM to the terminal device, themanagement server further needs to send a request for deregistering thetemporary data of the VSIM to the MSC on the mobile network, so that theMSC deregisters information that is about the temporary data of the VSIMand corresponding to the terminal device, and after receiving the formaldata of the VSIM, the terminal device may register with the mobilenetwork using the formal VSIM.

It should be noted that, after successfully providing the formal data ofthe VSIM to the terminal device, the management server may furtherinvoke a Provisioning system of an operator mobile network to stopusing, or recycle corresponding temporary VSIM so as to improveutilization of the temporary VSIM.

In the method embodiment, a management server first provides temporarydata of a VSIM and a service authentication code to a distributionclient, so that the terminal device may register with a mobile networkusing the temporary VSIM and further connect to the management server,and then in a case in which authentication is passed and formal data ofthe VSIM is in an unused state, sends the formal data of the VSIM to theterminal device, which overcomes a problem that distribution of data ofa VSIM is limited because the terminal device that does not have afunction of accessing a network cannot acquires the data of the VSIMfrom the management server. In addition, the temporary data of the VSIMand the service authentication code are used to improve security ofproviding, to a terminal device of a user using the distribution client,the data of the VSIM. Meanwhile, a graphic code that includes thetemporary data of the VSIM and the service authentication code isprovided to the terminal device using the distribution client, whichincreases flexibility and convenience of distributing the data of theVSIM, may maintain a system of distributing a physical SIM card of anoperator, and cause no impact on an existing operating sale system dueto the appearance of the data of the VSIM.

FIG. 3 is a schematic structural diagram of Embodiment 1 of a terminaldevice according to the present disclosure. As shown in FIG. 3, theterminal device 300 includes a first acquiring module 301, a secondacquiring module 302, a network processing module 303, a sending module304, and a receiving module 305.

The first acquiring module 301 is configured to acquire a graphic codefrom a distribution client, where the graphic code includes temporarydata of a VSIM and a service authentication code, and the graphic codeis provided by a management server to the distribution client.

The second acquiring module 302 is configured to acquire the temporarydata of the VSIM and the service authentication code that are includedin the graphic code.

The network processing module 303 is configured to register with amobile network according to the temporary data of the VSIM, and connectto the management server through the mobile network.

The sending module 304 is configured to send, to the management server,a request for downloading formal data of the VSIM, where the request fordownloading the formal data of the VSIM carries the serviceauthentication code, so that the management server performsauthentication on the terminal device according to the serviceauthentication code; and if the authentication is passed, the managementserver acquires formal data that is of the virtual subscriber identitymodule and corresponding to the service authentication code, and sendsthe formal data of the VSIM to the terminal device.

The receiving module 305 is configured to receive the formal data of theVSIM that is sent by the management server.

The network processing module 303 is further configured to register withthe mobile network according to the formal data of the VSIM.

The temporary data of the VSIM is temporarily valid, and is deregisteredafter the terminal device receives the formal data of the VSIM that issent by the management server, so that the terminal device reregisterswith the mobile network according to the formal data of the VSIM.

Preferably, the graphic code may be a two-dimensional code.

Preferably, the second acquiring module 302 is configured to scan thegraphic code to acquire the temporary data of the VSIM and the serviceauthentication code that are included in the graphic code.

Preferably, the first acquiring module 301 is configured to acquire thegraphic code from the distribution client using a camera.

Further, the terminal device 300 further includes a storage module 306and a writing module 307, where the storage module 306 is configured to,before the network processing module 303 registers with the mobilenetwork according to the temporary data of the VSIM, store the temporarydata of the VSIM; the writing module 307 is configured to write thetemporary data that is of the VSIM and stored by the storage module 306to a modem of the terminal device; the storage module 306 is furtherconfigured to, before the network processing module 303 registers withthe mobile network according to the formal data of the VSIM, store theformal data of the VSIM; and the writing module 307 is furtherconfigured to write the stored formal data of the VSIM to the modem ofthe terminal device, so as to overwrite the temporary data of the VSIMthat has been written to the modem.

The terminal device 300 provided in this embodiment may be configured toexecute the technical solution of the method embodiment shown in FIG. 1,and implementation principles and technical effects of the solution aresimilar and are not described again.

FIG. 4 is a schematic structural diagram of Embodiment 1 of a managementserver according to the present disclosure. As shown in FIG. 4, themanagement server 400 includes a graphic code encapsulating module 401,a providing module 402, a receiving module 403, an authentication module404, and a sending module 405, where the graphic code encapsulatingmodule 401 is configured to encapsulate temporary data of a VSIM and aservice authentication code in a graphic code, where the serviceauthentication code is used by a terminal device to download formal dataof the VSIM; the providing module 402 is configured to provide thegraphic code to a distribution client, so that the terminal deviceacquires the graphic code from the distribution client, further acquiresthe temporary data of the VSIM and the service authentication code,registers with a mobile network according to the temporary data of theVSIM, and sends, to the management server according to the serviceauthentication code, a request for downloading the formal data of theVSIM; the receiving module 403 is configured to receive the request,sent by the terminal device, for downloading the formal data of theVSIM, where the request for downloading the formal data of the VSIMcarries the service authentication code; the authentication module 404is configured to perform authentication on the terminal device accordingto the service authentication code; and the sending module 405 isconfigured to, if the authentication module 404 passes theauthentication, send formal data that is of the VSIM and correspondingto the service authentication code to the terminal device.

Preferably, before the sending module 405 sends the formal data that isof the VSIM and corresponding to the service authentication code to theterminal device, the authentication module 404 is further configured todetermine that a state of the formal data that is of the VSIM andcorresponding to the service authentication code is an unused state; andafter the sending module 405 sends the formal data that is of the VSIMand corresponding to the service authentication code to the terminaldevice, the authentication module 404 is further configured to mark thestate of the formal data of the VSIM as a used state.

Preferably, the graphic code is a two-dimensional code.

Optionally, after sending the formal data that is of the VSIM andcorresponding to the service authentication code to the terminal device,the sending module 405 is further configured to send, to the mobilenetwork, a request for deregistering the temporary data of the VSIM, sothat an MSC on the mobile network deregisters the temporary data of theVSIM, and the terminal device registers with the mobile networkaccording to the formal data of the VSIM.

The management server 400 provided in this embodiment may be configuredto execute the technical solution of the method embodiment shown in FIG.2, and implementation principles and technical effects of the solutionare similar and are not described again.

FIG. 5 is a schematic structural diagram of Embodiment 2 of a terminaldevice according to the present disclosure. As shown in FIG. 5, theterminal device 500 includes a processor 501, a memory 502, a modem 503,a first interface 504, and a second interface 505 that are connectedusing a bus (a thick solid line shown in FIG. 5), where the firstinterface 504 is configured to acquire a graphic code from adistribution client, where the graphic code includes temporary data of aVSIM and a service authentication code, and the graphic code is providedby a management server to the distribution client; the memory 502 isconfigured to store program code, and the processor 501 may perform theprogram code stored in the memory 502 so as to implement the followingsteps: acquiring, from the graphic code acquired by the first interface504, the temporary data of the VSIM and the service authentication codethat are included in the graphic code; storing, in the memory 502, thetemporary data of the VSIM and the service authentication code, andwriting the temporary data of the VSIM to the modem 503; invoking thesecond interface 505 so as to register with a mobile network accordingto the temporary data of the VSIM, and connect to the management serverthrough the mobile network; send, to the management server, a requestfor downloading formal data of the VSIM, where the request fordownloading the formal data of the VSIM carries the serviceauthentication code, so that the management server performsauthentication on the terminal device according to the serviceauthentication code; and if the authentication is passed, the managementserver acquires formal data that is of the virtual subscriber identitymodule and corresponding to the service authentication code, and sendsthe formal data of the VSIM to the terminal device; and receive theformal data of the VSIM that is sent by the management server; storing,in the memory 502, the formal data of the VSIM that is received by thesecond interface 505, and writing the formal data of the VSIM to themodem 503, so as to overwrite the temporary data of the VSIM that hasbeen written to the modem 503; and invoking the second interface 505 toregister with the mobile network according to the formal data of theVSIM.

Preferably, the first interface 504 that is included in the terminaldevice 500 is a camera; and the processor 501 may invoke the camera toacquire the graphic code from the distribution client.

Further, the first interface that is included in the terminal device 500may further be a USB interface, a BLUETOOTH interface, a WiFi networkconnection, and the like, which is not limited in the presentdisclosure.

The terminal device 500 provided in this embodiment may be configured toexecute the technical solution of the method embodiment shown in FIG. 1,and implementation principles and technical effects of the solution aresimilar and are not described again.

FIG. 6 is a schematic structural diagram of Embodiment 2 of a managementserver according to the present disclosure. As shown in FIG. 6, themanagement server 600 includes a processor 601, a memory 602, a firstinterface 603, and a second interface 604 that are connected using a bus(a thick solid line shown in FIG. 6), where the memory 602 may beconfigured to store temporary data of a VSIM, a service authenticationcode, formal data of the VSIM, and program code, and the processor 601may perform the program code stored in the memory 602 so as to implementthe following steps: encapsulating the temporary data of the VSIM andthe service authentication code in a graphic code; invoking the firstinterface 603 to provide the graphic code to a distribution client, sothat a terminal device acquires the graphic code from the distributionclient, further acquires the temporary data of the VSIM and the serviceauthentication code that are included in the graphic code, registerswith a mobile network according to the temporary data of the VSIM, andsends, to the management server according to the service authenticationcode, a request for downloading the formal data of the VSIM; and thefirst interface 603 may be an Ethernet interface, or an antennaconnector that has functions of receiving and sending, which is notlimited in the present disclosure; invoking the second interface 604 toreceive the request, sent by the terminal device, for downloading theformal data of the VSIM, where the request for downloading the formaldata of the VSIM carries the service authentication code; performingauthentication on the terminal device according to the serviceauthentication code; determining that a state of the formal data that isof the VSIM and corresponding to the service authentication code is anunused state; if the authentication is passed and it is determined thatthe state of the formal data of the VSIM is the unused state, invokingthe second interface 604 to send the formal data that is of the VSIM andcorresponding to the service authentication code to the terminal device;and marking the state of the formal data of the VSIM as a used state.

The second interface 604 may be the antenna connector that has thefunctions of receiving and sending and interacts with the terminaldevice through the mobile network.

The management server 600 provided in this embodiment may be configuredto execute the technical solution of the method embodiment shown in FIG.2, and implementation principles and technical effects of the solutionare similar and are not described again.

FIG. 7 is a schematic structural diagram of an embodiment of a systemfor distributing data of a VSIM according to the present disclosure. Asshown in FIG. 7, the system 700 for distributing the data of a VSIMincludes at least one terminal device 701, a management server 702, anda distribution client 703, where the terminal device 701 may be theterminal device shown in FIG. 3 or FIG. 5 and may be configured toexecute the technical solution of the method embodiment shown in FIG. 1;the management server 702 may be the management server shown in FIG. 4or FIG. 6 and may be configured to execute the technical solution of themethod embodiment shown in FIG. 2; and the distribution client 703 maybe the distribution client in the method embodiment shown in FIG. 1 orFIG. 2, and implementation principles and technical effects of thesolution are similar and details are not described again.

According to the descriptions of the embodiments, persons skilled in theart may clearly understand that the present disclosure may beimplemented by hardware, firmware or a combination thereof. When thepresent disclosure is implemented by software, the functions may bestored in a computer-readable medium or transmitted as one or moreinstructions or code in the computer-readable medium. Thecomputer-readable medium includes a computer storage medium and acommunications medium, where the communications medium includes anymedium that enables a computer program to be transmitted from one placeto another place. The storage medium may be any available mediumaccessible to a computer. For example, the computer readable medium mayinclude but is not limited to a random-access memory (RAM), a read-onlymemory (ROM), an electrically erasable programmable read-only memory(EEPROM), a compact disc read-only memory (CD-ROM), or another opticaldisc storage or magnetic disk storage medium, or another magneticstorage device, or any other medium that can carry or store desiredprogram code in a form of an instruction or a data structure and can beaccessed by a computer. In addition, any connection may be appropriatelydefined as a computer-readable medium. For example, if software istransmitted from a website, a server or another remote source using acoaxial cable, an optical fiber/cable, a twisted pair, a digitalsubscriber line (DSL) or wireless technologies such as infrared ray,radio and microwave, the coaxial cable, optical fiber/cable, twistedpair, DSL or wireless technologies such as infrared ray, radio andmicrowave are included in fixation of a medium to which they belong. Forexample, a disk and disc used by the present disclosure include acompact disc (CD), a laser disc, an optical disc, a digital versatiledisc (DVD), a floppy disk and a BLU-RAY disc, where a disk generallyreplicates data magnetically and a disc replicates data optically usinglaser. The combination should also be included in the protection scopeof the computer-readable medium.

Finally, it should be noted that the embodiments are merely intended fordescribing the technical solutions of the present disclosure, but notfor limiting the present disclosure. Although the present disclosure isdescribed in detail with reference to the embodiments, persons ofordinary skill in the art should understand that they may still makemodifications to the technical solutions described in the embodiments ormake equivalent replacements to some or all technical features thereof,without departing from the scope of the technical solutions of theembodiments of the present disclosure.

What is claimed is:
 1. A method for distributing data of a virtualsubscriber identity module, comprising: acquiring, by a terminal device,a graphic code, wherein the graphic code comprises temporary data of thevirtual subscriber identity module and a service authentication code,and wherein the graphic code is provided by a management server;acquiring, by the terminal device, the temporary data of the virtualsubscriber identity module and the service authentication code in thegraphic code; connecting to the management server according to thetemporary data of the virtual subscriber identity module; sending, bythe terminal device, to the management server a request for downloadingformal data of the virtual subscriber identity module, wherein therequest for downloading the formal data of the virtual subscriberidentity module carries the service authentication code, and wherein theformal data of the virtual subscriber identity module is acquired by themanagement server corresponding to the service authentication code whenthe authentication on the terminal device according to the serviceauthentication code is passed; receiving, by the terminal device, theformal data of the virtual subscriber identity module from themanagement server; and registering, by the terminal device, to a mobilenetwork according to the formal data of the virtual subscriber identitymodule.
 2. The method according to claim 1, wherein the graphic codecomprises a two-dimensional code.
 3. The method according to claim 1,wherein acquiring, by the terminal device, the temporary data of thevirtual subscriber identity module and the service authentication codein the graphic code comprises scanning, by the terminal device, thegraphic code to acquire the temporary data of the virtual subscriberidentity module and the service authentication code comprised in thegraphic code.
 4. The method according to claim 1, wherein acquiring, bythe terminal device, the graphic code comprises acquiring, by theterminal device, the graphic code from a distribution client using acamera.
 5. The method according to claim 1, further comprisingregistering, by the terminal device, to the mobile network according tothe temporary data of the virtual subscriber identity module.
 6. Themethod according to claim 1, wherein the graphic code comprises atwo-dimensional code, and wherein the two-dimensional code is acquiredby a camera.
 7. A method for distributing data of a virtual subscriberidentity module, comprising: encapsulating, by a management server,temporary data of the virtual subscriber identity module and a serviceauthentication code in a graphic code; providing, by the managementserver, the graphic code to a distribution client such that the terminaldevice acquires the graphic code from the distribution client, whereinthe temporary data of the virtual subscriber identity module and theservice authentication code is acquired by the terminal device;receiving, by the management server, from the terminal device, a requestfor downloading formal data of the virtual subscriber identity modulethat carries the service authentication code, wherein the temporary dataof a virtual subscriber identity module is used by the terminal deviceto connect to the management server; performing, by the managementserver, authentication on the terminal device according to the serviceauthentication code; and sending, by the management server, the formaldata of the virtual subscriber identity module corresponding to theservice authentication code to the terminal device when theauthentication is passed.
 8. The method according to claim 8, furthercomprising: determining, by the management server, a state of the formaldata of the virtual subscriber identity module corresponding to theservice authentication code is an unused state before sending, by themanagement server, the formal data of the virtual subscriber identitymodule corresponding to the service authentication code to the terminaldevice; and marking, by the management server, the state of the formaldata of the virtual subscriber identity module as a used state aftersending, by the management server, the formal data of the virtualsubscriber identity module corresponding to the service authenticationcode to the terminal device.
 9. The method according to claim 7, whereinthe graphic code comprises a two-dimensional code.
 10. The methodaccording to claim 7, wherein after sending, by the management server,the formal data of the virtual subscriber identity module to theterminal device, the method further comprises sending, by the managementserver to the mobile network, a request for deregistering the temporarydata of the virtual subscriber identity module such that a mobileswitching center (MSC) on the mobile network deregisters the temporarydata of the virtual subscriber identity module, and the terminal deviceregisters with the mobile network according to the formal data of thevirtual subscriber identity module.
 11. The method according to claim 7,wherein the graphic code comprises a two-dimensional code, and whereinthe two-dimensional code is acquired by a camera.
 12. A terminal device,comprising: a memory; a first interface; a second interface; and aprocessor coupled to the memory, the first interface, and the secondinterface; wherein the first interface is configured to acquire agraphic code, wherein the graphic code comprises temporary data of avirtual subscriber identity module and a service authentication code,wherein the graphic code is provided by a management server, wherein thememory is configured to store program code, and wherein the processorexecutes the program code to implement the following steps: acquire,from the graphic code acquired by the first interface, the temporarydata of the virtual subscriber identity module and the serviceauthentication code comprised in the graphic code; store, in the memory,the temporary data of the virtual subscriber identity module and theservice authentication code; invoke the second interface to: registerwith a mobile network according to the temporary data of the virtualsubscriber identity module; connect to the management server through themobile network; send, to the management server, a request fordownloading formal data of the virtual subscriber identity module,wherein the request for downloading the formal data of the virtualsubscriber identity module carries the service authentication code; andreceive the formal data of the virtual subscriber identity module fromthe management server, wherein the formal data of the virtual subscriberidentity module corresponding to the service authentication code isacquired by the management server when an authentication on the terminaldevice according to the service authentication code is passed; store, inthe memory, the formal data of the virtual subscriber identity modulereceived by the second interface; and invoke the second interface toregister with the mobile network according to the formal data of thevirtual subscriber identity module.
 13. The terminal device according toclaim 12, wherein the first interface comprises a camera, and whereinthe processor invokes the camera to acquire the graphic code.
 14. Theterminal device according to claim 12, wherein the temporary data of thevirtual subscriber identity module is temporarily valid and isderegistered after the terminal device reregisters to the mobile networkaccording to the formal data of the virtual subscriber identity module.15. The terminal device according to claim 12, wherein the graphic codecomprises a two-dimensional code.
 16. The terminal device according toclaim 12, wherein the graphic code comprises a two-dimensional code, andwherein the two-dimensional code is acquired by a camera.
 17. Amanagement server, comprising: a memory; a first interface; a secondinterface; and a processor coupled to the memory, the first interface,and the second interface; wherein the memory is configured to storetemporary data of a virtual subscriber identity module, a serviceauthentication code, formal data of the virtual subscriber identitymodule, and program instructions, and wherein the processor executes theprogram instructions to implement the following steps: encapsulate thetemporary data of the virtual subscriber identity module and the serviceauthentication code in a graphic code; invoke the first interface toprovide the graphic code to a distribution client such that a terminaldevice acquires the graphic code from the distribution client, whereinthe graphic code comprises the temporary data of the virtual subscriberidentity module and the service authentication code, and wherein thetemporary data of the virtual subscriber identity module is used by theterminal device to register to a mobile network; invoke the secondinterface to receive a request for downloading the formal data of thevirtual subscriber identity module, sent by the terminal device, whereinthe request for downloading the formal data of the virtual subscriberidentity module carries the service authentication code; performauthentication on the terminal device according to the serviceauthentication code; determine that a state of the formal data of thevirtual subscriber identity module corresponding to the serviceauthentication code is an unused state; invoke the second interface tosend the formal data of the virtual subscriber identity modulecorresponding to the service authentication code to the terminal devicewhen the authentication is passed; and mark the state of the formal dataof the virtual subscriber identity module as a used state.
 18. Themanagement server according to claim 17, wherein the graphic codecomprises a two-dimensional code.
 19. The management server according toclaim 17, wherein after sending the formal data of the virtualsubscriber identity module to the terminal device, the second interfaceis further configured to send, to the mobile network, a request forderegistering the temporary data of the virtual subscriber identitymodule such that a mobile switching center (MSC) on the mobile networkderegisters the temporary data of the virtual subscriber identitymodule, and the terminal device registers with the mobile networkaccording to the formal data of the virtual subscriber identity module.20. The management server according to claim 17, wherein the graphiccode comprises a two-dimensional code, and wherein the two-dimensionalcode is acquired by a camera.